Issue metadata
Sign in to add a comment
|
Security: [FG-VD-16-075] Adobe Flash Player Handing MP4 Out-of-Bounds Read Vulnerability
Reported by
kevinlu0...@gmail.com,
Nov 8 2016
|
||||||||||||||||||||
Issue descriptionVULNERABILITY DETAILS It is a Out-of-Bounds read vulnerability in MP4 processing. VERSION Adobe Flash Player 23.0.0.207 Other versions may be affected too REPRODUCTION CASE put LoadMP42.swf and FG-VD-16-075_PoC.mp4 on a server and load http://127.0.0.1:8080/LoadMP42.swf?file=FG-VD-16-075_PoC.mp4 run the following command line. flashplayer_23_sa_207.exe http://127.0.0.1:8080/LoadMP42.swf?file=FG-VD-16-075_PoC.mp4 Credits: This vulnerability was discovered by Kai Lu of Fortinet's FortiGuard Labs.
,
Nov 9 2016
,
Nov 9 2016
Sorry, I'm having trouble getting this to crash. What browser and OS do these work on?
,
Nov 9 2016
I tested it with flash player standalone in windows 7,10.(enable page heap) and also tested it in IE11 in Windows 7(enable page heap).
,
Nov 10 2016
still not test it in Chrome yet, I will test it right now.
,
Nov 12 2016
I'm still having trouble reproducing these, but I'm going to pass them to Adobe so they can investigate further. In the meantime, can you submit a sample that crashes in Chrome, as this is a Chrome rewards program?
,
Nov 15 2016
Ok,thanks. There are some crash samples for this case. I will try to find a sample that crashes in Chrome.
,
Nov 18 2016
Any update on triaging this? Thanks.
,
Nov 18 2016
Sorry, there isn't. I've reported it to Adobe, I'll let you know when I hear back.
,
Nov 21 2016
,
Nov 30 2016
Adobe has assigned this PSIRT-6012
,
Jan 10 2017
This was fixed as CVE-2017-2926 this month, it is ready for Rewards Panel.
,
Jan 10 2017
,
Jan 11 2017
,
Feb 18 2017
,
Feb 18 2017
The panel decided to award $500 for this report.
,
Feb 18 2017
,
Feb 20 2017
,
Mar 31 2017
,
Apr 19 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by rickyz@chromium.org
, Nov 9 2016Labels: Security_Severity-Medium
Owner: natashenka@google.com
Status: Assigned (was: Unconfirmed)